What it all means:<\/h2>\n\n- GDPR<\/a>: General Data Protection Regulation. A European law that affects everyone who does business with Europeans, and imposes strict limits on data collection and storage.<\/li>\n
- Cookies<\/a>: Code from websites that sits on your computer and tells the website, or other sites, about you. Used for advertising, marketing and making websites work.<\/li>\n
- CCPA<\/a>: California Consumer Privacy Act. Creates obligations to notify people about their data, let them see it, and opt out of having it used or sold. Applies to larger businesses with annual revenue over $25 million.<\/li>\n
- Tracking Pixel<\/a>: A tiny piece of code that lets companies follow users and see their behavior on the internet.<\/li>\n<\/ul>\n
What do you have to tell people who visit your site? And how should you put your privacy policy together?<\/p>\n
You could:<\/p>\n
Copy and paste someone else\u2019s privacy policy. Bad idea: theirs is probably out of date and this might be how they did it in the first place. You could be following someone who\u2019s following someone \u2014 who doesn\u2019t know the way.<\/p>\n
Copy and paste WordPress or another CMS\u2019 privacy policy. Also a bad idea; tons of it won\u2019t apply to you. And privacy policies can contain elements of contract; you might find yourself making promises in your privacy policy that you shouldn\u2019t be making or can\u2019t deliver on.<\/p>\n
Get a lawyer and have them write it. You can\u2019t go wrong (assuming you pick the right lawyer).<\/p>\n
However you do it, your privacy policy will need to include some crucial information.<\/p>\n
Here\u2019s what you need to know.<\/p>\n
What does my privacy policy need to include?<\/h2>\n
Your privacy policy now needs to be compliant with two new laws: the Californian CCPA<\/a> and the European GDPR<\/a>.\u00a0<\/p>\nWho does GDPR apply to?<\/h2>\n\n- Any company that processes data and is located in the EU, wherever the data is processed.<\/li>\n
- Any company that offers goods or services to EU citizens and processes their data. This one applies to a lot of businesses. If you\u2019re deliberately selling anything to EU citizens, GDPR probably applies to you<\/a>.\u00a0<\/li>\n<\/ul>\n
GDPR creates rights for European citizens, then obliges companies from everywhere in the world to respect those rights. Company location doesn\u2019t matter. And it applies to personally identifiable data, regardless of the business relationship. If someone can be identified by the data you\u2019re collecting, even if it\u2019s their business email address, GDPR applies. So, B2B businesses are not exempt.<\/p>\n
Unlike CCPA, there\u2019s no company size exemption to GDPR, though smaller businesses might be exempt from some specific elements, like the requirement to appoint a Data Protection Officer.<\/p>\n
Who does CCPA apply to?<\/h2>\n
For-profit companies that:<\/p>\n
\n- Have over $25 million annual gross revenue<\/li>\n
- Buy, receive or sell personal information of 50,000 or more California residents, households or devices<\/li>\n
- Derive 50% or more of their annual revenue from selling the personal information of California residents<\/li>\n<\/ul>\n
You don\u2019t need all of these \u2014 any single factor<\/i> on the list means you\u2019re covered by CCPA, wherever in the USA your business is located.<\/p>\n
(The Wikipedia page for GDPR<\/a> and CCPA<\/a> are good places to learn more, but you can just read this guide\u2026)<\/p>\nFinancial services and the Gramm-Leach-Billey Act<\/h2>\n
If you offer financial services your privacy policy should also be compliant with the Gramm-Leach-Billey Act<\/a>, which requires companies that offer financial products or services, including loans, advice and insurance, to explain how they share information and to safeguard sensitive data.<\/p>\nMedical services and HIPAA<\/h2>\n
If you offer medical services, you\u2019ll need to be compliant with HIPAA<\/a>. This includes some therapists; HIPAA covers anyone whose website stores or transmits protected health information (PHI).\u00a0<\/p>\nThat includes:<\/p>\n
\n- Identifiable demographic or genetic information related to health<\/li>\n
- Information that relates to the physical or mental condition of an individual<\/li>\n
- Payment or financial information related to healthcare<\/li>\n<\/ul>\n
This applies to any information-gathering tools on your website, including contact forms, patient reviews and testimonials, or live chat.\u00a0<\/p>\n
If you\u2019re collecting any information like this, HIPAA makes it your responsibility to take reasonable measures to protect it; if you\u2019re keeping personally identifiable information it should be on a server that\u2019s encrypted and secure.\u00a0<\/p>\n
Your email servers, web forms and all other communications used for PHI should also be encrypted and secure.<\/p>\n
What should your privacy policy include?<\/h2>\n
With these laws in mind, your privacy policy should tell visitors:\u00a0<\/p>\n
What data you\u2019re collecting and how<\/h3>\n
You don\u2019t have to be forensically accurate, but you do need to be clear enough that a normal person can figure out what you\u2019re doing. If you collect any personally identifiable information, say so and say what kind (names, medical information, IPs, phone numbers and email addresses). If you don\u2019t, say so.<\/p>\n
What you\u2019re going to use it for<\/h3>\n
Briefly tell visitors what you\u2019re using their data for. If it\u2019s to make some aspect of your business work, let them know.\u00a0<\/p>\n
Will any third parties have access to it?<\/h3>\n
If they do, you should tell your visitors. Are you selling it, or passing it on to someone else who will? Are you sharing it for professional reasons?\u00a0<\/p>\n
Visitors\u2019 data rights<\/h3>\n
Realistically, hardly anyone is going to want you to give them all their data. But you should tell people their rights.\u00a0<\/p>\n
Changes and dates<\/h3>\n
How will you notify visitors about changes? Even if you\u2019re not exactly planning on editing your privacy policy, laws and regulations can change. Tell visitors when your privacy policy comes into effect too.<\/p>\n
Active consent<\/h3>\n
GDPR requires that consent for data collection and processing be freely, clearly and actively given. \u2018By using this website, you agree\u2026\u2019 won\u2019t fulfill the requirements of GDPR, and neither will the pre-checked boxes we\u2019re used to seeing on cookie permission popups. Users shouldn\u2019t have to search for GDPR consent forms, so the best practice is a popup that lays out what you\u2019re doing in plain English, links to your full privacy policy, and requires a user action like checking a box actively to proceed. <\/p>\n
Google Analytics and user information<\/h2>\n
If you installed Google Analytics after October 14, 2020, there\u2019s good news: you\u2019re GDPR-compliant by default, because Google Analytics 4 anonymizes IP addresses by default.<\/p>\n
Legacy Google Analytics is not<\/b> GDPR-compliant \u2018out of the box.\u2019 (No EU customers and no plans to ever have any? Then you might not care.)\u00a0<\/p>\n
It collects visitors\u2019 IP addresses. You don\u2019t see them directly, but they go to the Geo reports, service provider reports, and can be used to filter results. The point is that collecting user IPs without permission violates GDPR and you\u2019re doing that with Google Analytics, even though you never actually see them directly.<\/p>\n
If you\u2019re using legacy Google Analytics, you can change its settings so it doesn\u2019t collect personally-identifiable information by changing the Javascript tag that Google Analytics uses to collect data.\u00a0<\/p>\n
Javascript is the programming language used for interactive and moving elements on websites. Your Google Analytics tag is in the Head section of your website\u2019s HTML.<\/p>\n
Out of the box, it collects users\u2019 whole IP address, which looks like this:<\/p>\n
![\"what](\"http:\/\/judinc.com\/blog\/wp-content\/uploads\/2021\/06\/what-an-IP-address-looks-like.png\")
<\/p>\n
What do you have to tell people who visit your site? And how should you put your privacy policy together?<\/p>\n
You could:<\/p>\n
Copy and paste someone else\u2019s privacy policy. Bad idea: theirs is probably out of date and this might be how they did it in the first place. You could be following someone who\u2019s following someone \u2014 who doesn\u2019t know the way.<\/p>\n
Copy and paste WordPress or another CMS\u2019 privacy policy. Also a bad idea; tons of it won\u2019t apply to you. And privacy policies can contain elements of contract; you might find yourself making promises in your privacy policy that you shouldn\u2019t be making or can\u2019t deliver on.<\/p>\n
Get a lawyer and have them write it. You can\u2019t go wrong (assuming you pick the right lawyer).<\/p>\n
However you do it, your privacy policy will need to include some crucial information.<\/p>\n
Here\u2019s what you need to know.<\/p>\n
What does my privacy policy need to include?<\/h2>\n
Your privacy policy now needs to be compliant with two new laws: the Californian CCPA<\/a> and the European GDPR<\/a>.\u00a0<\/p>\n GDPR creates rights for European citizens, then obliges companies from everywhere in the world to respect those rights. Company location doesn\u2019t matter. And it applies to personally identifiable data, regardless of the business relationship. If someone can be identified by the data you\u2019re collecting, even if it\u2019s their business email address, GDPR applies. So, B2B businesses are not exempt.<\/p>\n Unlike CCPA, there\u2019s no company size exemption to GDPR, though smaller businesses might be exempt from some specific elements, like the requirement to appoint a Data Protection Officer.<\/p>\n For-profit companies that:<\/p>\n You don\u2019t need all of these \u2014 any single factor<\/i> on the list means you\u2019re covered by CCPA, wherever in the USA your business is located.<\/p>\n (The Wikipedia page for GDPR<\/a> and CCPA<\/a> are good places to learn more, but you can just read this guide\u2026)<\/p>\n If you offer financial services your privacy policy should also be compliant with the Gramm-Leach-Billey Act<\/a>, which requires companies that offer financial products or services, including loans, advice and insurance, to explain how they share information and to safeguard sensitive data.<\/p>\n If you offer medical services, you\u2019ll need to be compliant with HIPAA<\/a>. This includes some therapists; HIPAA covers anyone whose website stores or transmits protected health information (PHI).\u00a0<\/p>\n That includes:<\/p>\n This applies to any information-gathering tools on your website, including contact forms, patient reviews and testimonials, or live chat.\u00a0<\/p>\n If you\u2019re collecting any information like this, HIPAA makes it your responsibility to take reasonable measures to protect it; if you\u2019re keeping personally identifiable information it should be on a server that\u2019s encrypted and secure.\u00a0<\/p>\n Your email servers, web forms and all other communications used for PHI should also be encrypted and secure.<\/p>\n With these laws in mind, your privacy policy should tell visitors:\u00a0<\/p>\n You don\u2019t have to be forensically accurate, but you do need to be clear enough that a normal person can figure out what you\u2019re doing. If you collect any personally identifiable information, say so and say what kind (names, medical information, IPs, phone numbers and email addresses). If you don\u2019t, say so.<\/p>\n Briefly tell visitors what you\u2019re using their data for. If it\u2019s to make some aspect of your business work, let them know.\u00a0<\/p>\n If they do, you should tell your visitors. Are you selling it, or passing it on to someone else who will? Are you sharing it for professional reasons?\u00a0<\/p>\n Realistically, hardly anyone is going to want you to give them all their data. But you should tell people their rights.\u00a0<\/p>\n How will you notify visitors about changes? Even if you\u2019re not exactly planning on editing your privacy policy, laws and regulations can change. Tell visitors when your privacy policy comes into effect too.<\/p>\n GDPR requires that consent for data collection and processing be freely, clearly and actively given. \u2018By using this website, you agree\u2026\u2019 won\u2019t fulfill the requirements of GDPR, and neither will the pre-checked boxes we\u2019re used to seeing on cookie permission popups. Users shouldn\u2019t have to search for GDPR consent forms, so the best practice is a popup that lays out what you\u2019re doing in plain English, links to your full privacy policy, and requires a user action like checking a box actively to proceed. <\/p>\n If you installed Google Analytics after October 14, 2020, there\u2019s good news: you\u2019re GDPR-compliant by default, because Google Analytics 4 anonymizes IP addresses by default.<\/p>\n Legacy Google Analytics is not<\/b> GDPR-compliant \u2018out of the box.\u2019 (No EU customers and no plans to ever have any? Then you might not care.)\u00a0<\/p>\n It collects visitors\u2019 IP addresses. You don\u2019t see them directly, but they go to the Geo reports, service provider reports, and can be used to filter results. The point is that collecting user IPs without permission violates GDPR and you\u2019re doing that with Google Analytics, even though you never actually see them directly.<\/p>\n If you\u2019re using legacy Google Analytics, you can change its settings so it doesn\u2019t collect personally-identifiable information by changing the Javascript tag that Google Analytics uses to collect data.\u00a0<\/p>\n Javascript is the programming language used for interactive and moving elements on websites. Your Google Analytics tag is in the Head section of your website\u2019s HTML.<\/p>\n Out of the box, it collects users\u2019 whole IP address, which looks like this:<\/p>\nWho does GDPR apply to?<\/h2>\n
\n
Who does CCPA apply to?<\/h2>\n
\n
Financial services and the Gramm-Leach-Billey Act<\/h2>\n
Medical services and HIPAA<\/h2>\n
\n
What should your privacy policy include?<\/h2>\n
What data you\u2019re collecting and how<\/h3>\n
What you\u2019re going to use it for<\/h3>\n
Will any third parties have access to it?<\/h3>\n
Visitors\u2019 data rights<\/h3>\n
Changes and dates<\/h3>\n
Active consent<\/h3>\n
Google Analytics and user information<\/h2>\n
<\/p>\n
![\"how](\"http:\/\/judinc.com\/blog\/wp-content\/uploads\/2021\/06\/how-to-keep-Google-Analytics-from-collecting-IP-addresses.png\")
<\/p>\n![\"website](\"http:\/\/judinc.com\/blog\/wp-content\/uploads\/2021\/06\/website-HTML-head-code-example.png\")
<\/p>\n![\"Google](\"http:\/\/judinc.com\/blog\/wp-content\/uploads\/2021\/06\/Google-Analytics-Global-Site-Tag.png\")
<\/p>\n